← Back to browse · API

CVE-2023-23488

Severity
CRITICAL
CVSS
9.8
EPSS
0.9246
Risk score
71.56
CISA KEV
No
PoC
No
Published
2023-01-20
Modified
2025-04-03
First seen
2026-08-07
Aliases
EUVD-2023-27588, GHSA-PPPW-HPJP-V2P9
Products
n/a:Paid Memberships Pro WordPress Plugin < 2.9.8
Sources
euvd EUVD-2023-27588

Description

The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpro/v1/order' REST route.

References